Privacy Notice

 

Diamond is committed to protecting the privacy and Personal Data of all Diamond Associates and adhering to best practices in complying with Data Protection Laws.

 

Diamond is the Data Controller and is responsible for Personal Data that any Diamond Associate shares with it. This notice aims to provide information on how Diamond Processes Personal Data of Diamond Associates that interact with Diamond, such as by (but not exclusive to):

 

• physically visiting Diamond, using Diamond’s website, signing up for events or newsletters (5.1);
• applying to use, and using, Diamond’s facilities (5.2);
• applying to be a Diamond employee or to work with Diamond in another capacity (e.g. as a contractor or via a collaboration), or being employed by Diamond, or working with Diamond in another capacity (e.g. as a contractor or via a collaboration) (5.3);
• partaking in a Diamond Committee Meeting or Diamond Peer Review Panel (5.4); or
• taking a thermometry test or Covid-19 test at Diamond or reporting a Covid-19 result to Diamond (5.5).

Diamond recognises the particular importance of protecting privacy where children are involved.  In the normal course of our business, Diamond does not collect Personal Data from children under the age of 13.  In the very limited circumstances where we may need to collect Personal Data of children under the age of 13 (for a special event for example), we will collect the Personal Data from the child’s parent or guardian.

 

Diamond’s website may include links to third-party websites, plug-ins and applications. Diamond does not control these third-party websites (which are outside the scope of this privacy notice) and is not responsible for any such third-party privacy statement. Where Diamond Associates click on third party website links or enable plug-ins or applications, they may allow parties to collect or share Data about them.

 

Diamond typically collects Personal Data when Diamond Associates, or the organisation that a Diamond Associate represents, provides it to Diamond.

 

Diamond may also collect information about criminal convictions when Diamond Associates, or the organisation that a Diamond Associate represents, provides it to Diamond.

 

 

Diamond uses different methods to collect Data from Diamond Associates, for example Diamond would normally collect Personal Data directly when they:

 

• enquire about using Diamond’s facilities;
• apply to use, or use Diamond’s facilities;
• physically visit Diamond;
• attend a Diamond event;
• sign up to one of Diamond’s mailing lists or subscribe to its newsletter;
• apply for a job at Diamond or otherwise enquire about career opportunities at Diamond;
• apply to work with Diamond, e.g. as a contractor or collaborator;
• register as a Diamond User;
• enter into a visiting scientist agreement;
• participate in a Diamond Committee Meeting or Diamond Peer Review Panel;
• partake in a Covid-19 test at Diamond or provide results of an external Covid-19 test to Diamond; or
• otherwise contact Diamond.

In certain instances, Diamond may receive Personal Data of a Diamond Associate from a third party. For example, Diamond may receive:

 

• Identity Data and Contact Data from an organisation that a Diamond Associate represents or from publicly available sources, such as Companies House or LinkedIn;
• information relating to the employment or work history of a prospective Diamond Employee, prospective Diamond Personnel or prospective Diamond Collaborator from their past or current employer or a recruitment agency; or
• Technical Data or Usage Data from third parties of publicly available sources, such as analytics providers (e.g. Google).

 

Diamond Processes Personal Data so far as is necessary to pursue legitimate interests as a research facility, a facilities provider, an employer, in pursuance of Diamond’s not-for-profit objectives, and in respect of facilitating Diamond’s relationship with, and commitment to, Diamond Associates.

 

The types of Data that Diamond may collect and the purpose for which Diamond collects that Data are set out below.

 

5.1 Diamond Visitors

 

5.1.1 Types of Data that may be collected:

 

• Identity Data;
• Contact Data;
• Profile Data;
• Organisation Data;
• Special Category Data, such as a Diamond Visitor’s nationality or information related to health or biometric Data;
• a copy of a Diamond Visitor’s photographic identification cards (e.g. passport or driving licence);
• education or professional history;
• images or other recording of a Diamond Visitor, captured by Diamond’s Surveillance Systems or images or other recording captured by Diamond for marketing, information or publicising purposes;
• vehicle registration number of a Diamond Visitor;
• information from a Diamond Visitor about their use of Diamond information, communication and technology systems;
• booking information (which may be via a third party) in relation to attendance at events or workshops at Diamond;
• feedback from Diamond Visitors in relation to their visit at Diamond, including in relation to any events or workshops that the Diamond Visitor has attended;
• access card records;
• dietary requirements;
• Marketing and Communications Data; and
• standard internet log information and details of online behaviour patterns (refer to Diamond’s Cookie Policy for further details).

5.1.2 Diamond’s Purpose(s) for using the Data:

 

• enabling Diamond Visitors to visit Diamond’s facilities;
• ensuring the health and safety of Diamond Visitors;
• ensuring the security of Diamond’s building, facilities and all Diamond Associates;
• improving Diamond’s facilities;
• administering events or workshops at Diamond, including the list of attendees and sending out any necessary correspondence in relation to such events and workshops;
• improving events and workshops at Diamond;
• processing and facilitating requests for school work experience where possible;
• publicising Diamond, its work and any events at Diamond;
• researching, analysing and reporting on the types and volume of visitors at Diamond;
• sending details of events to those that wish to attend them;
• marketing (which may be via a third-party provider);
• processing and facilitating visits and tours of Diamond (whether virtually or in-person);
• enabling Diamond Visitors to access Diamond’s buildings and facilities, e.g. by making any necessary adjustments;
• to enable Diamond to respond to, defend or initiate any legal proceedings, including any accidents at Diamond;
• analysing and improving a Diamond Visitor’s online experience in respect of Diamond’s website; and
• tracking how access cards are used.

5.2 Diamond Users

 

5.2.1 Types of Data that may be collected:

       

5.2.1.1 When Diamond Users wish to use Diamond’s facilities or register in the UAS:

 

• Identity Data;
• Contact Data;
• Organisation Data;
• Data Usage;
• Profile Data;
• Special Category Data, such as information related to their health;
• a copy of the Diamond User’s photographic identification card (e.g. passport or driving licence);
• ORCID ID (which will be mandatory for the principal investigator);
• details of the Diamond Users scientific/research history or background; and
• information in relation to the Diamond Users intended use of Diamond’s facilities.

5.2.1.2 When Diamond Users submit a proposal:

 

• a science overview, which includes a title, abstract, science case and science area to which the proposed use of Diamond’s facilities relates;
• Identity Data and Organisation Data for other investigators that are involved with the project;
• session relevant information, which includes the Diamond instrument on which a Diamond User proposes to work and answers to instrument specific questions;
• funding related information, which includes details of the research grants supporting the proposed research, an indication of whether a Diamond User has industrial support, and an indication of whether a Diamond Use has proposed similar research to other facilities (e.g. if the project has been funded through an EU grant with a transnational access component);
• start and end dates for the project; and
• experimental risk assessment, which will include information to help Diamond manage the risk(s) associated with the proposed experiment, including details of the samples the Diamond User proposes to study, details of any equipment they propose to bring to Diamond and details of the experimental methods they propose to use.

5.2.1.3 When Diamond Users are awarded laboratory or instrument time:

 

• details of any relevant health information, e.g. accessibility requirements;
• dates of the Diamond User’s session at Diamond;
• information relating to the success of the experiment (following the experimental stage);
• Contact Data if the Diamond User is carrying out remote access experiments;
• Financial Data where Diamond Users are eligible for out-of-pocket expenses;
• images or other recording of a Diamond User, captured by Diamond’s Surveillance Systems;
• the type or nature of the agreement between the Data User (of their affiliates and any representative organisation) and Diamond;
• vehicle registration numbers of a Diamond User;
• information from Diamond Users about their use of Diamond information, communication and technology systems; and
• access card records.

5.2.2 Diamond’s purpose(s) for using the Data:

 

5.2.2.1 When Diamond Users wish to use Diamond’s facilities or register in the UAS:

 

• setting up and administering an account for Diamond Users in the UAS;
• providing support services, such as through the UAS;
• uniquely identifying Diamond Users;
• enabling Diamond Users to be added to existing proposals or sessions for use of an instrument at Diamond;
• allowing registered Diamond Users to add other Diamond Users to a proposal or session for use of an instrument at Diamond;
• Processing, administering and reviewing (internally and externally using external reviewers or advisors such as peer reviewers and committee members) an application where a Diamond User has been added to a proposal or session for use of an instrument at Diamond;
• corresponding with Diamond Users in relation to their use of Diamond’s facilities;
• better understanding Diamond Users’ proposed use of Diamond’s facilities;
• booking laboratory sessions;
• enabling Diamond Users to participate in workshops or training events where they are required to complete health and safety training;
• assisting with peer review panel duties;
• booking travel and accommodation for Diamond Users where appropriate;
• providing Diamond Users with a contribution towards subsistence where appropriate;
• communicating with Diamond Users in relation to their status as a registered Diamond User;
• advising Diamond Users about upcoming calls for proposals at Diamond;
• administering UAS (e.g. troubleshooting, testing, system maintenance and support, including from external service providers where appropriate);
• analysing and reporting on the activities that Diamond provides and supports (e.g.: monitoring and reporting trends in registrations and to provide associated reports);
• monitoring Diamond Users’ compliance with Diamond’s terms and conditions of use;
• monitoring diversity and studying demographic trends in relation to Diamond Users;
• providing information to Diamond Users, which Diamond believes may be of interest to them in relation to their use of Diamond’s facilities; or
• providing information to Diamond Users about activities at Diamond or that are related to Diamond, which Diamond reasonably expects Diamond Users to be interested in.

5.2.2.2 When Diamond Users submit a proposal:

 

• the use cases set out at 5.2.2.1;
• sharing the information contained in the proposal with members of Diamond’s peer review panel and third parties for the purposes of peer review;
• enabling Diamond to ensure that the proposed work is possible;
• providing sufficient information for the proposal to be peer reviewed;
• facilitating a health and safety review of the proposed work;
• Processing, administering and reviewing (internally and externally, using external reviewers or advisors such as peer reviewers and committee members) the Diamond User’s application;
• contacting a Diamond User in relation to the proposal that they have submitted;
• ensuring that Diamond is able to enter into an agreement with the Diamond User;
• analysing the activities that Diamond provides and supports, for example monitoring and reporting trends in proposal submissions and producing associated reports; or
• conducting surveys with a view to developing and/or improving the services and facilities that Diamond provides.

5.2.2.3 When Diamond Users are awarded laboratory or instrument time:

 

• the use cases set out at 5.2.2.1 and 5.2.2.2;
• administering and managing the Diamond User’s session;
• printing the Diamond User’s name and photograph on their Diamond access card for identification and security purposes;
• contacting the Diamond User in relation to their session, before, during and after it, including sending the Diamond User emails relating to their session (e.g. changes to the session, changes to Diamond’s terms and conditions or policies or other communications relevant to the Diamond User);
• associating the Diamond User with the relevant Diamond instrument(s) so that they receive relevant content from Diamond;
• analysing and reporting on the activities that Diamond provides and supports, for example monitoring and reporting trends in use of Diamond’s facilities and providing associated reports;
• inviting Diamond Users to participate in meetings at Diamond which are relevant to their session, laboratory or instrument time, or their science area;
• inviting Diamond Users to participate in Diamond’s peer review panels, committees or in an advisory or support capacity at Diamond;
• contacting Diamond Users for their feedback and suggestions on how to improve the services that Diamond provides;
• analysing, Processing and reimbursing expenses that Diamond Users may be eligible for; and
• ensuring the Diamond User’s safety and the safety of others at Diamond and making any necessary and appropriate arrangements to ensure such safety, e.g. specific radiation monitoring, additional support or in relation to accessibility.

5.3 Diamond Employees, prospective Diamond Employees, Diamond Personnel, prospective Diamond Personnel, Diamond Collaborators and prospective Diamond Collaborators

 

5.3.1 Types of Data that may be collected:

 

• Identity Data;
• Contact Data;
• copies of photographic identification cards (e.g. passport or driving licence);
• Financial Data;
• details of professional qualifications and education;
• interview notes, curriculum vitae, covering letter or results from any psychometric tests;
• details of previous or current employment, education, work or similar, including;
  • name, address and contact details;
  • start and end dates;
  • salary, PAYE rate, dividends, compensation (whether cash or otherwise) and any other benefits;
  • job title(s);
  • working hours;
  • attendance records;
  • training records;
  • professional memberships;
  • references (including contact details for a referee);
  • disciplinary and grievance information;
  • performance information;
• Special Category Data such as information about health, nationality, religious beliefs, sexual orientation, political opinions, genetic information and biometric Data;
• start and end dates at Diamond;
• details of any criminal convictions and offences (including any driving related offences, however minor);
• trade union membership;
• Organisation Data;
• images or recordings captured by Diamond’s Surveillance Systems;
• information obtained through electronic means such as access card records;
• information about the use of Diamond’s information, communication and technology systems;
• information relating to expense claims;
• vehicle registration number;
• details of any dietary requirements;
• educational background, social mobility and geographical information;
• details of any applications a Diamond Employee, prospective Diamond Employee, Diamond Personnel, prospective Diamond Personnel, Diamond Collaborator or prospective Diamond Collaborator has made for other positions within Diamond;
• details of business-related social media of a Diamond Employee, prospective Diamond Employee, Diamond Personnel, prospective Diamond Personnel, Diamond Collaborator or prospective Diamond Collaborator;
• account login details for any online services provided by a third party;
• references that Diamond may receive or give in relation to a Diamond Employee, prospective Diamond Employee, Diamond Personnel, prospective Diamond Personnel, Diamond Collaborator or prospective Diamond Collaborator from time to time; and
• communications with managers, supervisors, Diamond’s HR team or others responsible for a Diamond Employee, prospective Diamond Employee, Diamond Personnel, prospective Diamond Personnel, Diamond Collaborator or prospective Diamond Collaborator.

5.3.2 Diamond’s purpose(s) for using the Data:

 

• Communicating with a Diamond Employee, prospective Diamond Employee, historic Diamond Employee, Diamond Personnel, prospective Diamond Personnel, historic Diamond Personnel, Diamond Collaborator, prospective Diamond Collaborator or historic Diamond Collaborator;
• making a decision on recruitment Processes;
• ensuring meaningful equal opportunity monitoring and to meet Diamond’s statutory obligations under the Equality Act 2010 and other relevant legislation monitoring business performance;
• recording absence from work (e.g. due to sickness) and making appropriate payments;
• determining fitness for work or to determine whether it is necessary to make reasonable adjustments for disability or to protect the health and safety of others;
• complying with right to work checks;
• determining employment status, including determining if the engagement is deemed employment for the purposes of Chapter 10 of Part 2 of the Income Tax (Earnings and Pensions) Act 2003 and providing a status determination statement where applicable in accordance with the applicable provisions of ITEPA 2003;
• making any necessary payments to trade union bodies;
• onboarding prospective Diamond Employees, prospective Diamond Personnel or prospective Diamond Collaborators (e.g. with Diamond’s Finance team and in relation to Diamond’s electronic, communication and technology systems);
• business management (including monitoring performance), internal reporting, accounting and auditing, business planning, policy development and equality monitoring;
• ensuring compliance with contracts made between Diamond and a Diamond Employee, prospective Diamond Employee, Diamond Personnel, prospective Diamond Personnel, Diamond Collaborator, prospective Diamond Collaborator, or other third party (e.g. obtaining Financial Data for payroll purposes or providing other benefits);
• conducting performance reviews;
• assessing pay grades and salary;
• liaising with pension trustees or managers;
• managing sickness absence;
• adhering to any legal or regulatory requirement imposed on Diamond from time to time (e.g. relating to tax, auto-enrolment for pension, work permits or immigration and managing health and safety at Diamond);
• management and administration of health and safety, grants, loans and other benefits;
• activities arising from a Diamond Employee, Diamond Personnel or Diamond Collaborator’s membership of Diamond committees or similar bodies;
• enabling Diamond to deal with and/or defend any dispute or legal proceedings, including accidents at work;
• gathering evidence for possible grievance, disciplinary hearings or legal disputes;
• making arrangements for the termination of the working relationship;
• providing references;
• education, training and development;
• preventing fraud;
• establishing whether Prospective Diamond Employees, Prospective Diamond Personnel or Prospective Diamond Collaborators are suitable for the role that they have applied for;
• booking travel or accommodation;
• Processing and facilitating any requests to attend events, conferences, workshops, training, or similar at Diamond or elsewhere;
• facilitating any dietary requirements;
• monitoring Diamond Employees, Diamond Personnel and Diamond Collaborators’ use of Diamond’s information, communication and technology systems to ensure compliance with Diamond’s IT policies;
• ensuring network and information security, including preventing unauthorised access to Diamond’s computer and electronic communications systems and preventing malicious software distribution;
• Facilitating access to online services;
• security (e.g. Surveillance Systems and maintenance of IT systems);
• to conduct Data analytics studies to better understand employee retention and attrition rates;
• managing and reporting any potential conflicts of interest;
• conducting employee surveys; and
• business management.

5.4 Diamond Committee Members and Diamond Peer Reviewers

 

5.4.1 Types of Data that may be collected:

 

• Finance Data;
• Identity Data;
• Contact Data;
• Organisation Data;
• details of any criminal convictions and offences (including any driving related offences, however minor);
• copies of photographic identification cards (e.g. passport or driving licence);
• details of professional or other qualifications, work or employment history and education;
• details of any requirements for accommodation or travel;
• images or other recording of a Diamond Committee Member or Diamond Peer Reviewer, captured by Diamond’s Surveillance Systems;
• start and end dates of the appointment at Diamond;
• details of any expenses incurred; and
• vehicle registration numbers 

5.4.2 Diamond’s purpose(s) for using the Data:

 

• Communicating with Diamond Committee Members, prospective Diamond Committee Members, historic Diamond Committee Members, Diamond Peer Reviewers, prospective Diamond Reviewers and historic Diamond Reviewers;
• Establishing the suitability of a prospective Diamond Committee Member or Diamond Peer Reviewer;
• assessing any potential conflicts of interest;
• contacting a prospective Diamond Committee Member or Diamond Peer Reviewer to invite them to participate in one (or more) Diamond Committee or a Peer Review Panel;
• setting up a Diamond Committee meeting or a Peer Review Panel, including notifying attendees of the meeting location (whether in person or virtually), the date, time and agenda (if applicable);
• administering the relationship between Diamond and a Diamond Committee Member or a Diamond Peer Reviewer;
• sharing relevant material for a Diamond Committee Member’s or Diamond Peer Reviewer activities;
• corresponding with a Diamond Committee Member or Diamond Peer Reviewer in connection with meetings and related committee activities;
• booking travel and accommodation of a Diamond Committee Member or Diamond Peer Reviewer;
• making payments of any honorarium to a Diamond Committee Member or Diamond Peer Reviewer for their services;
• contacting Diamond Committee Members or Diamond Peer Reviewers for feedback and suggestions for improvements on the services that Diamond provides or that would benefit them as a member of one (or more) Diamond Committee or as a Diamond Peer Reviewer; and
• publishing information (e.g. email address and name) on Diamond’s website in relation to Diamond Committee Members or Diamond Peer Reviewers to recognise their contribution and to enable Diamond Associates to contact them.

5.5 Thermometry Test Recipient and Covid-19 Test Recipients

 

As a result of the Covid-19 pandemic, Diamond has put in place additional measures (which include thermometry, lateral flow and polymerase chain reaction testing) to ensure the health and safety of all those that physically visit Diamond.

 

Diamond also operates an internal track and trace procedure for those that have attended site and tested positive for Covid-19 (either via an external test provider such as the NHS, or via Diamond’s lateral flow or polymerase chain reaction testing). Diamond is cooperating with third parties and with Public Health England in particular in relation to its requirement to report Covid-19 test results in order to protect the health and safety of others. These measures require Diamond to Process Personal Data.

 

5.5.1 Types of Data that may be collected:

 

• Identity Data;
• Contact Data;
• Special Category Data (e.g. ethnicity, health related information, including the Covid-19 test result, the date of the test, details of diagnosis, how the Covid-19 Test Recipient contracted the virus, who they have come into contact with, details of their general condition and their NHS number);
• details of the Covid-19 Test Recipient’s travel movements since becoming symptomatic, including whether they have physically visited Diamond;
• a Covid-19 Test Recipient or Thermometry Test Recipient’s Diamond Federated Identifier (if applicable);
• reasons for declining to take part in thermometry, lateral flow and polymerase chain reaction testing; and
• images of the Covid-19 Test Recipient captured by Diamond’s Surveillance System or images taken of a Thermometry Test Recipient by Diamond, for the purpose of thermometry testing;

5.5.2 Diamond’s purpose(s) for using the Data:

 

• complying with government, Public Health England or NHS instructions, requirements, guidelines or recommendations in relation to reducing the spread of Covid-19 and reporting positive Covid-19 test results (including, under the Health Protection (Notification) (Amendment) (Coronavirus) Regulations 2020, which requires Diamond to notify Public Health England of a positive or indeterminate result within 24 hours of a positive result and within seven days in the case of a negative or void result);
• ensuring the safety and well-being of Diamond Employees, Diamond Personnel or any person that that physically visits Diamond;
• checking the temperature of a Thermometry Test Recipient;
• creating a photo-ID sticker which persons physically visiting Diamond must place on their name badge or other visible place on their person;
• receiving and Processing thermometry, lateral flow and polymerase chain reaction test results;
• returning test results to the Thermometry Test Recipient or Covid-19 Test Recipient;
• sharing necessary Personal Data of Covid-19 Test Recipients with:
  • persons managing and administering the Covid-19 testing programme and track and trace at Diamond;
  • those that may have come into contact with the Covid-19 Test Recipient;
  • the Covid-19 Test Recipient’s manager / host organisation;
  • regulatory agencies (e.g. Public Health England and the Health and Safety Executive); and
  • third parties that provide services to Diamond.

Diamond will keep Personal Data that is provided to it by Diamond Associates for as long as is necessary to fulfil the purposes for which Diamond has collected it. This may mean that Diamond retains a Diamond Associate’s Personal Data for a period of time (typically up to seven years) after they have ceased to have a relationship with Diamond, where this is necessary for Diamond to satisfy a legal, accounting or reporting requirement. In the case of Diamond Committee Members and Diamond Peer Reviewers, Diamond may keep a record of their Personal Data indefinitely, for the purpose of ensuring that Diamond does not ask persons to join a Diamond Committee or Diamond Peer Review Panel that have historically refused or been unable to join.

 

In determining the appropriate period of time for retaining Personal Data, Diamond considers: the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure of the Personal Data, the purpose for which Diamond Processes Personal Data and whether Diamond can achieve those purposes through other means, and the applicable legal requirements.

 

In relation to Thermometry Testing Recipients, Diamond has installed a Wello station, which Processes a photographic image of the Thermometry Testing Recipient. The image is then printed on a photo-ID sticker, which they must wear whilst visiting Diamond. The Wello station then immediately deletes the photographic image.

 

Any Diamond Associate (specifically including Diamond Users) with a UAS login must update their details on the system as soon as there is a change. Diamond recommends that Diamond Associates review the details at least once a year to ensure that their Personal Data remains up-to-date and accurate.

 

Where a Diamond Associate has been provided with a Federal Identifier, Diamond will retain the following Personal Data indefinitely:

 

•    UAS person identification;
•    Federal Identifier; 
•    first name; and
•    surname.
 

Status	User Description	Personal Data Retained	Timeline
Enabled	Where a Diamond Associate is registered in UAS and undertakes an annual check and confirmation of Personal Data.	Identity Data; Organisation Data; Special Category Data, including nationality; and a copy of a photographic identification card (being a passport or driving licence).   In addition, they may have chosen to submit an ORCID ID (or have been required to provide this as a principal investigator on a project).	Each year Diamond Associates that are registered in UAS will be prompted to log in to it their account to check and confirm their personal details by email. On each annual anniversary of when a Diamond Associate last logged into their UAS account, they will need to check and confirm their details in order to progress in the UAS.
Unconfirmed	Where a Diamond Associate has an active UAS account, but the correctness of their Personal Data is not known.  Any record that has not been confirmed for over one year is classed as being unconfirmed.	Identity Data; Organisation Data; Special Category Data, including nationality; and a copy of a photographic identification card (being a passport or driving licence).   In addition, they may have chosen to submit an ORCID ID (or have been required to provide this as a principal investigator on a project).	Automatically carried out one year after the user last confirmed their details OR manually carried out if information is known to be incorrect.
Reduced	Where a Diamond Associate is an active Diamond User that can log in to UAS, but some personal details are reduced by Diamond.  Persons with a reduced person record can log in to UAS, but will immediately be prompted to confirm their details.  Any record that has not been confirmed for over one year, and which has not been active at Diamond for three years, will be reduced by Diamond. The Personal Data is retained for the purposes of reporting and account recovery.	Identity Data; Organisation Data; Special Category Data, including nationality; and Federal Identifier	Manually carried out if the Diamond User requests removal of Personal Data from UAS within three years of being active OR automatically carried out if the record has not been confirmed within the last year and the Diamond User has not been active at Diamond within the last three years.
Archived	When a Diamond Associate’s Personal Data has been deleted from the UAS and they can no longer log in to the UAS as a result of their Personal Data record not being confirmed within the last year and where the user has not been active at Diamond within the last ten years.	Federal Identifier.	Manually carried out if the Diamond User requests the removal of their Personal Data from the UAS within seven days. OR automatically carried out if the record has not been confirmed within the last year and the Diamond User has not been active at Diamond within the last ten years.
Deleted	Users can no longer log in to UAS and the only information retained is the Federal Identifier.  These are typically records that were created in error.	Personal details will no longer be held in UAS and users will need to be reactivated by UAS or re-register

 

The Personal Data that Diamond collects is typically necessary in order to provide an effective service and to ensure the health and safety of all Diamond Associates. Where Diamond does not require certain Personal Data, Diamond will make this clear. Where Diamond Associates are not sure on whether the submission of Personal Data is compulsory or mandatory, they can contact legal@diamond.ac.uk.

 

Where Diamond Associates do not provide certain Personal Data when requested, Diamond may not be able to perform the service that are requested by a Diamond Associate, e.g. enabling a Diamond User to use Diamond’s facilities, sending mail updates about Diamond events, carrying out or completing recruitment or onboarding of prospective Diamond Employees, Diamond Personnel or Diamond Collaborators, or appointing a prospective Diamond Committee Member to a Diamond Committee.

 

It is important that the Personal Data Diamond holds about a Diamond Associate is accurate and that the Diamond Associate notifies Diamond at the earliest possible opportunity if their Personal Data needs updating. 
 

 

Diamond may share Personal Data for the purposes described in this privacy notice.  Some of these parties may be outside the United Kingdom.  Diamond does not sell Personal Data or share it for third party advertising or marketing purposes.

 

    8.1    Inside of Diamond

 

Diamond may share information in relation to Diamond Associates internally for legitimate and necessary purposes, including Processing purposes outlined above. Some examples of where Diamond may share Personal Data internally, include:

 

• administering UAS;
• recruitment and onboarding of prospective Diamond Employees, Diamond Personnel, Diamond Collaborators;
• organising or booking events;
• responding to any Data Subject Access Requests;
• dealing with any legal disputes;
• responding to any auditing and reporting requirements;
• complying with any legal or regulatory obligation; and
• Processing payroll.

 

Personal Data is accessible as appropriate to those that need to be involved in managing, administering and monitoring UAS accounts and Diamond User interactions with Diamond and the research that it supports.  This includes (but is not limited to) Diamond’s user office (which is responsible for allocating beamtime), Diamond’s Health and Safety team, Diamond’s laboratory services personnel, Diamond’s Finance team, software developers, and peer reviewers.

 

    8.2    Outside of Diamond

 

For the purposes set out in this privacy notice and in circumstances where it would be legitimate and necessary to do so, Diamond may share Diamond Associate’s Personal Data or a subset of their Personal Data, with a variety of stakeholders, third-party service providers, suppliers, partners, associated organisations and agents.  Where possible, Diamond will share information on an anonymised basis.  Where Diamond is not able to provide anonymised data, it will only information to the extent that it is necessary and in compliance with Data Protection Laws. Diamond will require that all third parties receiving Personal Data from Diamond: use if for the specified purpose, in accordance with Diamond’s instructions and that they treat it in accordance with Data Protection Laws.  Examples of third parties that Diamond may share Personal Data with, include:

 

• Diamond’s shareholders or associated organisations;
• Diamond’s funders or funding partners;
• a Diamond Associate funder or funders; 
• an organisation that a Diamond Associate represents;
• universities and research institutes for the purpose of: monitoring, evaluation, research and learning;
• external reviewers and advisors such as peer reviewers and committee members or others who advise Diamond in relation to the services that it offers;
• Diamond’s IT and communications systems providers) and Diamond’s expenses system software provider;
• those managing the issue of Federated Identification credentials, access control and other IT services;
• travel agents, hotels, and transportation providers;
• cashless payment providers at the Harwell Campus;
• catering service providers;
• email communications provider that distributes emails on Diamond’s behalf;
• prospective employers of Diamond Employees, Diamond Personnel or Diamond Collaborators (e.g. providing references and employment dates);
• recruitment agencies, with which Diamond may share feedback of any candidates;
• marketing organisations (e.g. Diamond may share Identity Data and Contact Data so that third party marketing organisations can send marketing information on Diamond’s behalf);
• journalists and press agencies to publish details of Diamond related work;
• learning management system providers (e.g. Diamond may share Identify Data and Organisation Data);
• virtual networking platforms (e.g. Diamond may provide Identity Data and Organisation Data to set up user accounts);
• event venue operators and online ticketing platforms in respect of Diamond-run events;
• survey providers for collecting feedback or other useful information;
• mortgage or rental organisations; 
• mobile phone providers;
• banks;
• cloud based services;
• external advisors (e.g. solicitors or auditors) and
• government, public or regulatory bodies or agencies, courts, legal service providers or law enforcement bodies or agencies.

We have listed some of the key services carried out by third-party processors here.
 

 

Diamond is committed to safeguarding Personal Data and has put in place appropriate security measures to prevent a Diamond Associate’s Personal Data from accidentally being lost, altered, disclosed or used or accessed in an unauthorised way.  In addition, Diamond limits access to Personal Data to those Diamond Employees, Diamond Personnel and other third parties who have a business need to know, who will be under a duty of confidentiality and who will only Process Diamond Associate’s Personal Data on instructions from Diamond. 

 

There may be occasions when Diamond transfers Diamond Associate’s Personal Data outside the UK, for example, if Diamond communicates with Diamond Associates using a cloud-based service provider that operates outside the UK. Such transfers will only take place if one of the following applies:

 

• the country receiving the Personal Data is considered to provide an adequate level of Data protection;
• the organisation receiving the Personal Data is covered by an arrangement recognised as providing an adequate standard of Data protection;
• the transfer is governed by approved contractual clauses;
• the Diamond Associate has consented to the transfer;
• the transfer is necessary for the performance of a contract with the Diamond Associate or to take steps requested by the Diamond Associate prior to entering into that contract;
• the transfer is necessary for the performance of a contract with another person, which is in the Diamond Associate’s interests;
• the transfer is necessary in order to protect the Diamond Associate’s vital interests or of those of other persons, where the Diamond Associate or other persons are incapable of giving consent;
• the transfer is necessary for the exercise of legal claims; or
• the transfer is necessary for important reasons of public interest.

It is important to note that Diamond may display limited Identity Data, Organisation Data and employment history on its website, which will be accessible by internet users (who may or may not be based in the UK).
 

 

Automated decision-making takes place when an electronic system uses Personal Data to make decisions without human intervention.  Diamond does not expect to make decisions about Diamond Associated based on automated decision-making or profiling unless Diamond has a lawful basis for doing so and it has notified the Diamond Associate. 

 

Where Diamond Processes Personal Data on the basis of a Diamond Associate’s consent, they have the right to withdraw their consent for that Processing at any time.  Once Diamond has received notification that a Diamond Associate has withdrawn their consent, Diamond will take steps to ensure that it no longer Processes the Diamond Associate’s Personal Data for the purpose or purposes they originally agreed to as soon as possible, unless Diamond has another legitimate and legal basis for retaining it.
 

It is also important to highlight that under certain circumstances, by law Diamond Associates have the right to:

 

• make a Subject Access Request. This enables the Diamond Associate to receive a copy of the Personal Data that Diamond holds on them and to check that Diamond is Processing it lawfully;
• request correction of the Personal Data that Diamond holds on them. This enables the Diamond Associate to have any incomplete or inaccurate information that Diamond holds on them corrected;
• request erasure of their Personal Data. This enables Diamond Associates to ask Diamond to delete or remove Personal Data where there is no good reason for Diamond continuing to Process it.  Diamond Associates also have the right to ask Diamond to delete or remove their Personal Data where they have exercised their right to object to its Processing;
• object to Processing of their Personal Data where Diamond relies on a legitimate interest and there is something about the Diamond Associate’s particular situation which makes them want to object to Processing on this ground.  Diamond Associate’s also have the right to object where Diamond is Processing their Personal Data for direct marketing purposes;
• request the restriction of Processing of their Personal Data. This enables the Diamond Associate to ask Diamond to suspend the Processing of Personal Data about them, for example if a Diamond Associate wants Diamond to establish its accuracy or the reason for Processing it; and
• request the transfer of their Personal Data to another party.

If a Diamond Associate wants to review, verify, correct or request erasure of their Personal Data, object to the Processing of their Personal Data, or request that Diamond transfers a copy of their Personal Data to another party, they should contact Diamond’s legal team at legal@diamond.ac.uk.
 

If a Diamond Associate would like a copy of the Personal Data that Diamond holds about them or if they are a Diamond Employee and they receive such a request from an individual, they should contact legal@diamond.ac.uk with the words "Subject Access Request" in the subject line and include:

 

• specific details of the information requested;
• any dates that are relevant to the search request;
• Identity Data;
• Contact Data; and
• any preferences for the manner in which the search response should be given (e.g. email, on a disk or printed out).

 

Diamond will respond to such request up to one calendar month of the date of request, or in respect of complex requests, Diamond may respond within three calendar months, starting from the day of receipt. By way of example, if a simple Subject Access Request is made on 3 September, Diamond will have until 3 October to respond to the request. In the event of a complex Subject Access Request being made on 3 September, Diamond will have until 3 December to respond.

 

Where Diamond has requested something from the Diamond Associate, e.g. ID documents, that are required to deal with the Data Subject Access Request, the calendar month will start on the day Diamond receives the necessary information or documents. Where the end date falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day. Therefore, if a simple Data Subject Access Request is received on 31 July and 31 August is a bank holiday, Saturday or Sunday, then Diamond will need to respond to the request on the next working day.
 

Diamond Associates will not have to pay a fee to access their Personal Data (or to exercise any of the other rights).  However, Diamond may charge a reasonable fee if the request for access is clearly unfounded or excessive, or Diamond may refuse to comply with the request. Diamond may also request a fee from the Diamond Associate if they request further copies of their information following a Subject Access Request.

Diamond may need to request specific information from the Diamond Associate to help it confirm their identity and ensure their right to access the information (or to exercise any of their other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it.
 

 

Diamond understands that there are differences amongst Diamond Associates in terms of the protected characteristics contained within the Equality Act 2010 (i.e. age, disability, gender reassignment, marriage & civil partnerships, pregnancy & maternity, race, religion or belief, sex (gender) and/or sexual orientation). Diamond therefore aims to deliver policies, documents and services which are efficient and effective, accessible to all, and which meet Diamond Associate’s different needs. Diamond Associates that need help to understand this document or require any appropriate support should contact Diamond’s Human Resources team (hr@diamond.ac.uk).

 

If any Diamond Associates have any questions about this privacy notice, or Diamond’s privacy practices they should contact Diamond’s Data Protection Officer. Diamond’s Data Protection Officer is Paul Jeffreys and he can be contacted at paul.jeffreys@diamond.ac.uk.

 

This privacy notice should be read in conjunction with Diamond’s Cookie Policy and Data Protection Policy.

 

In order to ensure that Diamond’s privacy notice is up to date and accurate, Diamond may make changes to it from time to time. All Diamond Associates should regularly check this notice for updates. This privacy notice was last updated on 8 March 2024. 

 

For the purposes of this notice, the following definitions shall apply:

 

Contact Data: billing address, delivery address, email address(es), telephone number(s) next of kin name and contact details or details of another emergency contact.

 

Covid-19 Test Recipient: any Diamond Associate (or other person) that physically visits Diamond and partakes in Diamond's lateral flow or polymerase chain reaction testing or that has taken a Covid-19 test externally and have notified Diamond of a positive test result.

 

Data: information, whether stored electronically, or in paper-based filing systems. 

 

Data Controllers: the people who, or organisations which determine the manner in which any Personal Data is Processed. They are responsible for establishing practices and policies to ensure compliance with Data Protection Laws.

 

Data Processors: any person or organisation that is not a Data User (or other employee of a Data Controller) that Processes Data on Diamond’s behalf and in accordance with our instructions (for example, a supplier which handles Data on Diamond’s behalf).

 

Data Protection Laws: means the General Data Protection Regulation 2016 (Regulation (EU) 2016/679) (the “GDPR”), the Data Protection Act 2018 and any laws that replace or amend any of these, together with all other applicable law, regulations, guidance and codes of conduct relating to the Processing of Personal Data, Data, cyber security and privacy, including any guidance and codes of practice issued by the Information Commissioner’s Office or any relevant supervisory authority, the Article 29 Working Party, or the European Data Protection Board from time to time.

 

Data Protection Officer: Paul Jeffreys (contactable at paul.jeffreys@diamond.ac.uk). 

 

Data Subject Access Request: a request by a Data Subject for the disclosure of their Personal Data.

 

Data Subjects: all living individuals about whom Diamond holds Personal Data on.

 

Data Users: Diamond Employees and Diamond Personnel whose work involves Processing Personal Data. 

 

Diamond: Diamond Light Source Limited, a company incorporated and registered in England and Wales, with company number 4375679 and with registered office at Diamond House, Harwell Science & Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom.

 

Diamond Associate: Diamond Visitor, historic Diamond Visitor, Diamond User, historic Diamond User, Diamond Employee, prospective Diamond Employee, historic Diamond Employee, Diamond Personnel, prospective Diamond Personnel, historic Diamond Personnel, Diamond Collaborator, prospective Diamond Collaborator, historic Diamond Collaborator, Diamond Committee Member, historic Diamond Committee Member, Diamond Peer Reviewer, historic Diamond Peer Reviewer, Thermometry Test Recipient or Covid-19 Test Recipient.

 

Diamond Collaborator: Diamond Personnel that collaborates with Diamond.

 

Diamond Committee: the committees at Diamond, being: the committees coordinated by Diamond, such as the Scientific Advisory Committee and the Audit Risk and Finance Committee or as these committees may be varied from time to time.

 

Diamond Committee Member: a member of a Diamond Committee. 

 

Diamond Employee: any person working for Diamond under a contract of employment.

 

Diamond Personnel: any person or organisation that works with, or for Diamond, or that is an agent, agency worker, intern, contractor, subcontractor, appointee, secondee, student (including schools/colleges work experience students), third-party representative, fellow, volunteer, external consultant, business partner, supplier, sponsor, director or office holder of Diamond, a Diamond Peer Reviewer, Diamond Committee Member, Diamond User or Diamond Collaborator and who is not a Diamond Employee.

 

Diamond Peer Reviewer: a member of a Diamond Peer Review Panel.

 

Diamond Peer Review Panel: a panel convened for the purpose of reviewing a Diamond User’s proposal to use Diamond’s facilities and that will accordingly approve or reject the proposal.

 

Diamond User, Diamond User's and Diamond Users': any person that uses or applies to use (whether directly or indirectly) or any affiliates of the person that made the application to use Diamond’s facilities and who may have access to UAS. 

 

Diamond Visitor: any person that physically or virtually visits Diamond (including any person that partakes in any workshop, event or tour (whether online or in person) or any person that visits or otherwise uses Diamond’s website from time to time.

 

Federated Identifier: the federal identifier provided by Diamond to a Diamond User, Diamond Employee or Diamond Personnel.

 

Financial Data:     bank account, payment card details, tax status information and any HMRC information as required.

 

Identity Data: first name(s), last name(s), maiden name(s), username, or similar identifier, marital status, title, date of birth, national insurance number and gender.

 

Marketing and Communications Data: Diamond Associates preferences in receiving marketing and communication from Diamond and Diamond’s third parties.

 

Organisation Data: details of the organisation that a Diamond Associate represents, including the organisation’s name, address, the Diamond Associate’s position within the organisation and any contact details for the Diamond Associate at the organisation, e.g. organisation specific email address or contact number.

 

Personal Data: Data relating to a living natural person who can be identified from that Data such as certain types of Identity Data, Contact Data, Financial Data, Organisation Data, Transaction Data, Technical Data, Profile Data, Usage Data, or Marketing and Communications Data, which may or may not include Special Category Personal Data and does not included anonymised information or aggregated Data as this does not directly or indirectly reveal an individual’s identity.

 

Process, Processed, Processing, or Processes: any activity which involves the use of Data. It includes obtaining, recording or holding Data, or carrying out any operation on the Data, including organising, amending, retrieving, using, disclosing or destroying it or transferring Data to third parties.

 

Profile Data: a Diamond Associate’s username or password, details of any purchases or orders made by a Diamond Associate and any survey responses or details of any interests, preferences or feedback that have been provided by a Diamond Associate.

 

Special Category Personal Data: Personal Data that needs more protection because it is sensitive and relates to an identified or identifiable individual that falls within special categories, such as racial or Data that relates to: ethnic origin, political views or opinions, religious or philosophical beliefs, health, sex life, sexual orientation, genetics, trade union membership and biometric Data when used for identification purposes. 

 

Surveillance Systems: Diamond’s surveillance systems.

 

Technical Data: internet protocol address, a Diamond Associates login details, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices the Diamond Associate uses on Diamond’s website.

 

Thermometry Test Recipient: a person that received a thermometry test at Diamond.

 

Transaction Data: details about payment to and from Diamond Associates and other details of services Diamond Associates have purchased from Diamond.

 

UAS: Diamond’s User Administration System

 

Usage Data: information about how Diamond Associates use Diamond’s website, and any Diamond products and services.
 

Please, access a printable version of this Privacy Policy - Published 04/12/2023.